Barracuda Networks, a computer security company whose ads you can't miss if you ever visit an airport, fell victim to a security breach over the weekend. Barracuda has plenty of company in the computer security industry -- RSA and Comodo were also recent victims of security breaches.
Of course, people have been quick to excoriate security companies for security failures. Alan Shimel and Bill Brenner have written good articles about the folly of thinking that this couldn't happen to any company. Based on the number of significant breaches in the past few months, security companies may be targets right now for attacks.
Something to commend about the recent breaches: companies have been fairly responsible in reporting what has happened. It can't be pleasant to announce a breach, but it is important to own up to what happened, and we can all learn lessons from what was vulnerable and how vulnerabilities were exploited.
Something else good: companies have been able to determine what happened and how using data from their monitoring and logging systems.
I hope that one of the lessons we learn from these breaches is to layer security technologies and compartmentalize subsystems so that failure of any one point does not result in exposure of the entire system. Unfortunately, today we often have such complex systems that it is hard to make sure we have sufficient layers to manage the risks.
No comments:
Post a Comment